8 ms·

> Comcast sniffs / records / tracks their user's DNS traffic Actually not only does Comcast say they don't do that (https://www.xfinity.com/privacy/policy/dns

> Comcast sniffs / records / tracks their user's DNS traffic Actually not only does Comcast say they don't do that (https://www.xfinity.com/privacy/policy/dns https://www.xfinity.com/privacy/policy/dns) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong pro-privacy philosophy. (disclosure: I work for Comcast and have been working on encrypted DNS)

hellcow 6y ago
Respectfully, Comcast has an ATROCIOUS privacy record. Full stop. A quick search came up with [1] [2] [3]. Your employer actively and repeatedly abuses the privacy and trust of its customers. It also lobbies for damaging policies. I do not trust Comcast. Firefox associating itself with Comcast makes me trust Firefox significantly less. [1] https://oag.ca.gov/news/press-releases/attorney-general-kamala-d-harris-reaches-33-million-settlement-comcast-over https://oag.ca.gov/news/press-releases/attorney-general-kama... [2] https://www.king5.com/article/news/local/comcast-fined-9-million-for-violating-washingtons-consumer-protection-act/281-b52a12ff-d09b-4b3a-aa95-f3f0e5a85703 https://www.king5.com/article/news/local/comcast-fined-9-mil... [3] https://consumerist.com/2016/04/01/comcast-says-fcc-privacy-rules-will-hurt-consumers-by-not-allowing-them-to-see-more-ads-online/ https://consumerist.com/2016/04/01/comcast-says-fcc-privacy-...
- metaphor 6y ago
  > Your employer... It also lobbies for damaging policies. To be sure, jlivingood isn't just some enterprise grunt with an opinion, but VP of Technology Policy & Standards.
  - ndesaulniers 6y ago
    I'm the queen of England.
  - godelski 6y ago
    Do you have a link for this? This is a pretty big difference in disclosure.
    - deleted 6y ago
      [deleted]
    - hellcow 6y ago
      https://blog.mozilla.org/blog/2020/06/25/comcasts-xfinity-internet-service-joins-firefoxs-trusted-recursive-resolver-program/ https://blog.mozilla.org/blog/2020/06/25/comcasts-xfinity-in... Compare the username to the "Vice President, Technology Policy and Standards at Comcast Cable" in this blog post.
      - godelski 6y ago
        Thanks! To save people the click. User name in question: jlivingood > Jason Livingood, Vice President, Technology Policy and Standards at Comcast Cable.
Paul-ish 6y ago
If Comcast sells DNS data now, they open themselves up to penalties from the both FTC and Mozilla. FTC because they enforce privacy policies, and Mozilla because of the contract they have. I would say this Mozilla changing the overall ecosystem for the better.
- jlgaddis 6y ago
  Do we know what the actual penalties are? I have trouble believing that they are of any substance. Additionally, I think it's safe to say that Comcast has years and years of experience in finding "loopholes" and/or other "workarounds" in its agreements. > I would say this Mozilla changing the overall ecosystem for the better. You obviously have much more faith in Comcast than I do. Let's hope you're right.
  - Forbo 6y ago
    > Do we know what the actual penalties are? I have trouble believing that they are of any substance. So long as the penalty is less than the value they derive from violating the agreement, they will abuse it.
  - gsich 6y ago
    No. And Mozilla can't verify it either.
- elliekelly 6y ago
  The FTC has no teeth and no one at Comcast is losing any sleep over potential FTC penalties. Ajit Pai is more likely encourage meaningful enforcement of this agreement than anyone at the FTC. Which is to say, I don’t have much faith.
- catalogia 6y ago
  What good is a contract between Mozilla and Comcast to me if Mozilla is unwilling to notice/care/sue when Comcast breaks that contract because Mozilla has a financial incentive to turn a blind eye?
- rwha 6y ago
luma 6y ago
Comcast has had a pretty poor track record w/r/t their statements of what they do or don't do versus reality, and this goes back well over a decade (see: denials of Sandvine deployment). I personally was impacted by this behavior after having my internet service deactivated due to going over bandwidth caps (which reportedly didn't yet exist) and it was one of the most Kafka-esque corporate experiences in my life. My internet was being deactivated because I violated a policy which they repeatedly stated didn't exist. Several months later those caps actually became policy. I ask this with all sincerity: why should we believe Comcast?
jlgaddis 6y ago
> Actually not only does Comcast say they don't do that... Just like they said they didn't forcibly reset BitTorrent connections (until they did). Just like they said they didn't silently institute bandwidth caps (until they did). Just like they said they didn't hijack NXDOMAIN responses (until they did). Just like they said they didn't intercept plain-text HTTP connections and inject their own traffic into them (until they did). --- With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one! Surely you can understand why, to me and many others, their little agreement with Mozilla doesn't really mean a damn thing? --- (I know that none of this is your fault and it's obviously nothing personal! I'm sure you're a smart, decent person but I'm also sure that you are well aware of your employer's reputation, their past "misdeeds", and, of course, the generally unfavorable opinion that many, many customers have of them.)
- roblabla 6y ago
  > With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one! Consumer contracts? Because Mozilla having a business contract with Comcast is certainly not the same as you having a consumer contract - Mozilla has the resources to drag Comcast to court should they be found to ignore the agreement.
  - pbhjpbhj 6y ago
    Where can we read the contract?
    - wrkronmiller 6y ago
      The policy linked by the article is here: https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforcement https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforc...
      - pwdisswordfish2 6y ago
elliekelly 6y ago
That’s great that they’ve said they don’t publicly and that they’re now going to be contractually obligated not to... but that’s kind of irrelevant if they are actually sniffing, tracking, and/or recording user DNS traffic. And the fact that Comcast doesn’t allow users to change the DNS settings of xfinity routers leads me to believe they have some monetary incentive to go in and disable that functionality in their equipment.
xxpor 6y ago
The link provided only concerns logging of DNS requests on Comcast's DNS servers themselves. It doesn't say anything about recording packets to UDP port 53 in general. If Comcast were recording every packet I sent to 8.8.8.8 they wouldn't be breaking the letter of the policy.
- booi 6y ago
  Hopefully this is exactly what DoH should be addressing.
LeifCarrotson 6y ago
It is entirely possible for one group (or incentive) within Comcast's organization to work towards that goal, and another group or incentive within Comcast to work against it. Some things that make me trust this claim: - That privacy policy - That contract - Association with trustworthy brands like Mozilla - Work on encrypted DNS - Consumer trust could theoretically be financially valuable to them - Basic morals of Comcast employees Some things that make me distrust it: - Cultivated an infamous litany of consumer abuses - Lobbied for regulations to harm consumers - Engaged in regulatory capture with the FTC/FCC - Have continually profited from their abusive business practices, and continue to profit in spite of atrocious levels of consumer trust I believe that Comcast only wants to respect user privacy insofar as it helps them maintain a facade of trustworthiness and retain customers. If they ever get the opportunity to back out of that privacy-conscious posturing and turn it into money, I think history has proven that the winner of those two internal groups is clearly going to be the money side not the moral side.
- boopmaster 6y ago
  I am a Comcast employee myself, but these opinions are my own: I appreciate your comment as you clearly and accurately frame that good people work there, Comcast earned its reputation with its actions, and that there may be competing interests / morals at play. I can’t predict the future to say what wins out, but I feel like there are competing interests at play internal to the org. There are the business/markets, and then there is technology, products and experience pieces too. an aside: I am somewhat disappointed to see a HN thread so populated with groupthink “Comcast is bad!” I’d expect that on theVerge comment board or YouTube comments. sigh Anyways, I hear that the wake up call was probably about the time that the time warner merger fell through. I haven’t worked for them that long. It takes time to shift an org as large as Comcast to come to terms with the public’s resentment. I can say that, in my experience on the inside, the fundamental attitudes are very consumer friendly. I’m on the tech/product side of the house and we just want to make great stuff. Reliable, scalable entertainment and home automation kind of things, ya know? Comcast strives to be an admired company. So yeah, guess its work is cut out for it! Everything is designed today with accessibility and privacy at the outset. There’s a massive amount of truly brilliant engineers, developers, QA folks etc. working there. Not saying your distrust in Comcast wasn’t earned, however I believe conditions are not what they once were, thus some negative sentiments may be outdated today.
pbhjpbhj 6y ago
Given your disclosure presumably you know if it's true or not. It's a weird way to phrase "I work on this, we don't capture any information about customers site visits" or "I work on this we don't capture any information about domain lookups" or whatever. When a customer gets a contract with Comcast are you saying the contract includes that Comcast will not filter/log their domain lookups in any way? To others: what's the penalty of they breech that contract? Do they actual have anything at risk? In UK ISPs couldn't make such a contract as the gov obliges DNS filtering of some domains, AIUI.
- tialaramex 6y ago
  UK ISPs could offer to operate a Mozilla TRR DoH server for two reasons: 1. The deal major "as seen on TV" ISPs struck was that they would offer a configurable child protection style filtering to their users. Mozilla permits users to opt in to filtering, you just aren't allowed to filter by default, so an ISP provided DoH server which can be configured explicitly to filter would meet this requirement. NextDNS offers this, yet is in Mozilla's programme. If you just pick NextDNS from the drop-down in Firefox you get no filtering, if you sign up and pay them (or take the free offer) you get filtering of your choice, and DoH, with instructions on how to tell your Firefox about this (basically paste a per-user URL into a preferences window, the nice thing about DoH compared to plain DNS or even DoT is that in a URL your user identifier will be encrypted, improving privacy) 2. The government did not legislate a requirement. They've been burned before on the difference between public appeals to think of the children (generally broadly accepted by the populace, no legal fallout) and censorship laws (likely to be destroyed in the courts because it turns out people don't like being told what to read). All those famous ISPs chose to voluntarily censor the Internet (mustn't let kids see porn) and then since they had the capability to censor courts told them to also obey Hollywood's instructions (no Pirate Bay either). A small ISP like Andrews & Arnold isn't censored. During sign-up it says "Do you need child friendly filtering as part of this product?" or something. If you click "Yes" it says sorry they don't want you as a customer, good bye and the sign-up process is over.
  - pbhjpbhj 6y ago
    I chose "oblige" carefully. Basically the ISPs AIUI/IIRC were given the option to voluntarily abide by a blocklist of domains - like thepiratebay - or have legislation made to force them to comply. I'd heard A&A were an outlier here but didn't know they actively stopped users from choosing their service if they want filtering. That seems weirdly fascist: like a supermarket that won't let you choose not to have Coca Cola on your shopping list, if you don't want it you have to actively remove it yourself. Porn, yes to some extent, but super-violence, torture, malware, gambling, prostitution, ... these are all things I choose to attempt not to pipe in to my home via OpenDNS/pihole/uBlock/direct instruction to local users!
pwdisswordfish2 6y ago
Can users enforce that contract if it is breached? Maybe users should be named explicitly as third party beneficiaries. Mozilla is a company and needs to compensate its CEO and staff. The CEO received $2,458,350 in 2018.^1 Everything Mozilla does cannot be solely for users' benefit. Mozilla, the people behind it, have their own financial interests. 1. https://assets.mozilla.net/annualreport/2018/mozilla-2018-form-990.pdf https://assets.mozilla.net/annualreport/2018/mozilla-2018-fo...
organsnyder 6y ago
You work(ed) on IPv6 as well, right? You get all the fun projects. :-)
m463 6y ago
> Comcast sniffs / records / tracks their user's DNS traffic what if the are your dns server?

hellcow 6y ago

Respectfully, Comcast has an ATROCIOUS privacy record. Full stop. A quick search came up with [1] [2] [3]. Your employer actively and repeatedly abuses the privacy and trust of its customers. It also lobbies for damaging policies. I do not trust Comcast. Firefox associating itself with Comcast makes me trust Firefox significantly less. [1] https://oag.ca.gov/news/press-releases/attorney-general-kamala-d-harris-reaches-33-million-settlement-comcast-over https://oag.ca.gov/news/press-releases/attorney-general-kama... [2] https://www.king5.com/article/news/local/comcast-fined-9-million-for-violating-washingtons-consumer-protection-act/281-b52a12ff-d09b-4b3a-aa95-f3f0e5a85703 https://www.king5.com/article/news/local/comcast-fined-9-mil... [3] https://consumerist.com/2016/04/01/comcast-says-fcc-privacy-rules-will-hurt-consumers-by-not-allowing-them-to-see-more-ads-online/ https://consumerist.com/2016/04/01/comcast-says-fcc-privacy-...

metaphor 6y ago
> Your employer... It also lobbies for damaging policies. To be sure, jlivingood isn't just some enterprise grunt with an opinion, but VP of Technology Policy & Standards.
- ndesaulniers 6y ago
  I'm the queen of England.
- godelski 6y ago
  Do you have a link for this? This is a pretty big difference in disclosure.
  - deleted 6y ago
    [deleted]
  - hellcow 6y ago
    https://blog.mozilla.org/blog/2020/06/25/comcasts-xfinity-internet-service-joins-firefoxs-trusted-recursive-resolver-program/ https://blog.mozilla.org/blog/2020/06/25/comcasts-xfinity-in... Compare the username to the "Vice President, Technology Policy and Standards at Comcast Cable" in this blog post.
    - godelski 6y ago
      Thanks! To save people the click. User name in question: jlivingood > Jason Livingood, Vice President, Technology Policy and Standards at Comcast Cable.

Paul-ish 6y ago

If Comcast sells DNS data now, they open themselves up to penalties from the both FTC and Mozilla. FTC because they enforce privacy policies, and Mozilla because of the contract they have. I would say this Mozilla changing the overall ecosystem for the better.

jlgaddis 6y ago
Do we know what the actual penalties are? I have trouble believing that they are of any substance. Additionally, I think it's safe to say that Comcast has years and years of experience in finding "loopholes" and/or other "workarounds" in its agreements. > I would say this Mozilla changing the overall ecosystem for the better. You obviously have much more faith in Comcast than I do. Let's hope you're right.
- Forbo 6y ago
  > Do we know what the actual penalties are? I have trouble believing that they are of any substance. So long as the penalty is less than the value they derive from violating the agreement, they will abuse it.
- gsich 6y ago
  No. And Mozilla can't verify it either.
elliekelly 6y ago
The FTC has no teeth and no one at Comcast is losing any sleep over potential FTC penalties. Ajit Pai is more likely encourage meaningful enforcement of this agreement than anyone at the FTC. Which is to say, I don’t have much faith.
catalogia 6y ago
What good is a contract between Mozilla and Comcast to me if Mozilla is unwilling to notice/care/sue when Comcast breaks that contract because Mozilla has a financial incentive to turn a blind eye?
rwha 6y ago

luma 6y ago

Comcast has had a pretty poor track record w/r/t their statements of what they do or don't do versus reality, and this goes back well over a decade (see: denials of Sandvine deployment). I personally was impacted by this behavior after having my internet service deactivated due to going over bandwidth caps (which reportedly didn't yet exist) and it was one of the most Kafka-esque corporate experiences in my life. My internet was being deactivated because I violated a policy which they repeatedly stated didn't exist. Several months later those caps actually became policy. I ask this with all sincerity: why should we believe Comcast?

jlgaddis 6y ago

> Actually not only does Comcast say they don't do that... Just like they said they didn't forcibly reset BitTorrent connections (until they did). Just like they said they didn't silently institute bandwidth caps (until they did). Just like they said they didn't hijack NXDOMAIN responses (until they did). Just like they said they didn't intercept plain-text HTTP connections and inject their own traffic into them (until they did). --- With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one! Surely you can understand why, to me and many others, their little agreement with Mozilla doesn't really mean a damn thing? --- (I know that none of this is your fault and it's obviously nothing personal! I'm sure you're a smart, decent person but I'm also sure that you are well aware of your employer's reputation, their past "misdeeds", and, of course, the generally unfavorable opinion that many, many customers have of them.)

roblabla 6y ago
> With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one! Consumer contracts? Because Mozilla having a business contract with Comcast is certainly not the same as you having a consumer contract - Mozilla has the resources to drag Comcast to court should they be found to ignore the agreement.
- pbhjpbhj 6y ago
  Where can we read the contract?
  - wrkronmiller 6y ago
    The policy linked by the article is here: https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforcement https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforc...
    - pwdisswordfish2 6y ago

elliekelly 6y ago

That’s great that they’ve said they don’t publicly and that they’re now going to be contractually obligated not to... but that’s kind of irrelevant if they are actually sniffing, tracking, and/or recording user DNS traffic. And the fact that Comcast doesn’t allow users to change the DNS settings of xfinity routers leads me to believe they have some monetary incentive to go in and disable that functionality in their equipment.

xxpor 6y ago

The link provided only concerns logging of DNS requests on Comcast's DNS servers themselves. It doesn't say anything about recording packets to UDP port 53 in general. If Comcast were recording every packet I sent to 8.8.8.8 they wouldn't be breaking the letter of the policy.

booi 6y ago
Hopefully this is exactly what DoH should be addressing.

LeifCarrotson 6y ago

It is entirely possible for one group (or incentive) within Comcast's organization to work towards that goal, and another group or incentive within Comcast to work against it. Some things that make me trust this claim: - That privacy policy - That contract - Association with trustworthy brands like Mozilla - Work on encrypted DNS - Consumer trust could theoretically be financially valuable to them - Basic morals of Comcast employees Some things that make me distrust it: - Cultivated an infamous litany of consumer abuses - Lobbied for regulations to harm consumers - Engaged in regulatory capture with the FTC/FCC - Have continually profited from their abusive business practices, and continue to profit in spite of atrocious levels of consumer trust I believe that Comcast only wants to respect user privacy insofar as it helps them maintain a facade of trustworthiness and retain customers. If they ever get the opportunity to back out of that privacy-conscious posturing and turn it into money, I think history has proven that the winner of those two internal groups is clearly going to be the money side not the moral side.

boopmaster 6y ago
I am a Comcast employee myself, but these opinions are my own: I appreciate your comment as you clearly and accurately frame that good people work there, Comcast earned its reputation with its actions, and that there may be competing interests / morals at play. I can’t predict the future to say what wins out, but I feel like there are competing interests at play internal to the org. There are the business/markets, and then there is technology, products and experience pieces too. an aside: I am somewhat disappointed to see a HN thread so populated with groupthink “Comcast is bad!” I’d expect that on theVerge comment board or YouTube comments. sigh Anyways, I hear that the wake up call was probably about the time that the time warner merger fell through. I haven’t worked for them that long. It takes time to shift an org as large as Comcast to come to terms with the public’s resentment. I can say that, in my experience on the inside, the fundamental attitudes are very consumer friendly. I’m on the tech/product side of the house and we just want to make great stuff. Reliable, scalable entertainment and home automation kind of things, ya know? Comcast strives to be an admired company. So yeah, guess its work is cut out for it! Everything is designed today with accessibility and privacy at the outset. There’s a massive amount of truly brilliant engineers, developers, QA folks etc. working there. Not saying your distrust in Comcast wasn’t earned, however I believe conditions are not what they once were, thus some negative sentiments may be outdated today.

pbhjpbhj 6y ago

Given your disclosure presumably you know if it's true or not. It's a weird way to phrase "I work on this, we don't capture any information about customers site visits" or "I work on this we don't capture any information about domain lookups" or whatever. When a customer gets a contract with Comcast are you saying the contract includes that Comcast will not filter/log their domain lookups in any way? To others: what's the penalty of they breech that contract? Do they actual have anything at risk? In UK ISPs couldn't make such a contract as the gov obliges DNS filtering of some domains, AIUI.

tialaramex 6y ago
UK ISPs could offer to operate a Mozilla TRR DoH server for two reasons: 1. The deal major "as seen on TV" ISPs struck was that they would offer a configurable child protection style filtering to their users. Mozilla permits users to opt in to filtering, you just aren't allowed to filter by default, so an ISP provided DoH server which can be configured explicitly to filter would meet this requirement. NextDNS offers this, yet is in Mozilla's programme. If you just pick NextDNS from the drop-down in Firefox you get no filtering, if you sign up and pay them (or take the free offer) you get filtering of your choice, and DoH, with instructions on how to tell your Firefox about this (basically paste a per-user URL into a preferences window, the nice thing about DoH compared to plain DNS or even DoT is that in a URL your user identifier will be encrypted, improving privacy) 2. The government did not legislate a requirement. They've been burned before on the difference between public appeals to think of the children (generally broadly accepted by the populace, no legal fallout) and censorship laws (likely to be destroyed in the courts because it turns out people don't like being told what to read). All those famous ISPs chose to voluntarily censor the Internet (mustn't let kids see porn) and then since they had the capability to censor courts told them to also obey Hollywood's instructions (no Pirate Bay either). A small ISP like Andrews & Arnold isn't censored. During sign-up it says "Do you need child friendly filtering as part of this product?" or something. If you click "Yes" it says sorry they don't want you as a customer, good bye and the sign-up process is over.
- pbhjpbhj 6y ago
  I chose "oblige" carefully. Basically the ISPs AIUI/IIRC were given the option to voluntarily abide by a blocklist of domains - like thepiratebay - or have legislation made to force them to comply. I'd heard A&A were an outlier here but didn't know they actively stopped users from choosing their service if they want filtering. That seems weirdly fascist: like a supermarket that won't let you choose not to have Coca Cola on your shopping list, if you don't want it you have to actively remove it yourself. Porn, yes to some extent, but super-violence, torture, malware, gambling, prostitution, ... these are all things I choose to attempt not to pipe in to my home via OpenDNS/pihole/uBlock/direct instruction to local users!

pwdisswordfish2 6y ago

Can users enforce that contract if it is breached? Maybe users should be named explicitly as third party beneficiaries. Mozilla is a company and needs to compensate its CEO and staff. The CEO received $2,458,350 in 2018.^1 Everything Mozilla does cannot be solely for users' benefit. Mozilla, the people behind it, have their own financial interests. 1. https://assets.mozilla.net/annualreport/2018/mozilla-2018-form-990.pdf https://assets.mozilla.net/annualreport/2018/mozilla-2018-fo...

organsnyder 6y ago

You work(ed) on IPv6 as well, right? You get all the fun projects. :-)

m463 6y ago

> Comcast sniffs / records / tracks their user's DNS traffic what if the are your dns server?